For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

PicassoMendez's avatar
PicassoMendez
Icon for Nimbostratus rankNimbostratus
Oct 04, 2013

iRule config to Rewrite SSL Header for Transactions

We need to pull three values out of the Client SSL and put them in the Server SSL. Currently we tried using a rule that creates a Session Table to store these. Since this is a API and not a web page we are having timeout issues. Any suggestions on rewriting this would help.

This is part of what we are using.

when CLIENTSSL_CLIENTCERT {

Check if client presented at least one cert if {[SSL::cert count] > 0}{

   Insert the following fields in the session table with a timeout of 7200 seconds:
     Do the processing now as opposed to in HTTP_REQUEST as there
     can be many HTTP requests using the same SSL session ID
  
     Index - item
     1 - serial number of the cert
     2 - issuer of the cert
     3 - subject of the cert
  session add ssl [SSL::sessionid] [list \
     [SSL::verify_result] \
     [X509::serial_number [SSL::cert 0]] \
     [X509::issuer [SSL::cert 0]] \
     [X509::subject [SSL::cert 0]] \
  ] 7200

  log local0. "[IP::client_addr]:[TCP::client_port]: Added session data for cert. Status:\
     [X509::verify_cert_error_string [lindex [session lookup ssl [SSL::sessionid]] 0]] with key [SSL::sessionid]"

} }

12 Replies

  • You just need to replace the section in your code where you generate the HTTP headers in the HTTP_REQUEST event. In my last example, I used the SSL session table that you created in the CLIENTSSL_CLIENTCERT event. That should work fine. Alternatively, and again this I believe depends on BIG-IP version, you could skip the SSL session table and simply render the SSL::cert data directly in the HTTP_REQUEST event.